{"record":{"id":"d2227ee651133405","repo":"shadow1ng/fscan","slug":"i18n-gettext-ms17010-not-vulnerable","errorCode":null,"errorMessage":"i18n.GetText(\"ms17010_not_vulnerable\")","messagePattern":"i18n\\.GetText\\(\"ms17010_not_vulnerable\"\\)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"info","filePath":"plugins/services/ms17010.go","lineNumber":81,"sourceCode":"\t\t\tmsg += fmt.Sprintf(\" [%s]\", osVersion)\n\t\t}\n\t\tsession.LogVuln(msg)\n\t\tif hasBackdoor {\n\t\t\tsession.LogVuln(fmt.Sprintf(\"MS17-010 %s has DOUBLEPULSAR SMB IMPLANT\", target))\n\t\t}\n\n\t\treturn &ScanResult{\n\t\t\tSuccess: true,\n\t\t\tType:    plugins.ResultTypeVuln,\n\t\t\tService: \"ms17010\",\n\t\t\tBanner:  i18n.Tr(\"ms17010_vuln_banner\", osVersion),\n\t\t}\n\t}\n\n\treturn &ScanResult{\n\t\tSuccess: false,\n\t\tService: \"ms17010\",\n\t\tError:   fmt.Errorf(\"%s\", i18n.GetText(\"ms17010_not_vulnerable\")),\n\t}\n}\n\n// Exploit 执行MS17-010漏洞利用\nfunc (p *MS17010Plugin) Exploit(ctx context.Context, info *common.HostInfo, creds Credential, session *common.ScanSession) *ExploitResult {\n\tconfig := session.Config\n\ttarget := info.Target()\n\tsession.LogSuccess(i18n.Tr(\"ms17010_start\", target))\n\n\tvar output strings.Builder\n\toutput.WriteString(i18n.Tr(\"ms17010_exploit_header\", target) + \"\\n\")\n\n\t// 首先确认漏洞存在\n\tvulnerable, osVersion, hasBackdoor, err := p.checkMS17010Vulnerability(ctx, info.Host, session)\n\tif err != nil {\n\t\toutput.WriteString(\"\\n\" + i18n.Tr(\"ms17010_exploit_check_failed\", err) + \"\\n\")\n\t\treturn &ExploitResult{\n\t\t\tSuccess: false,","sourceCodeStart":63,"sourceCodeEnd":99,"githubUrl":"https://github.com/shadow1ng/fscan/blob/95cc12e753bf43de7004e5aef42a9ffba3934303/plugins/services/ms17010.go#L63-L99","documentation":"The MS17-010 Scan plugin returns a non-success ScanResult whose Error field carries the localized message \"ms17010_not_vulnerable\" when the SMB probe completed without error but the target was determined NOT to be vulnerable to EternalBlue (checkMS17010Vulnerability returned vulnerable=false). It is not an exceptional failure: it is how the plugin reports a 'clean' host via the uniform ScanResult error channel.","triggerScenarios":"Calling MS17010Plugin.Scan on a host with port 445 open where the SMB negotiation/trans2 probe completes but the target does not exhibit the MS17-010 vulnerable behavior (no proper SMB response patterns indicating EternalBlue, no DOUBLEPULSAR backdoor).","commonSituations":"Scanning patched Windows hosts (post MS17-01x updates), non-Windows SMB implementations (Samba), or hosts where SMBv1 was disabled but 445 still answers; also misreading a benign result as a failure.","solutions":["Treat Success==false with this Error as an informational 'not vulnerable' verdict, not a crash — check Error text before alarming.","Confirm the target actually exposes SMBv1 on 445 (e.g. with an SMB probe) if you expected it to be vulnerable; MS17-010 requires SMBv1.","Verify patch status on the host; if it is patched, this result is correct and no action is needed.","If you expected the plugin to skip the host, pre-filter targets by port 445 before invoking Scan (port != 445 yields ms17010_port_only instead)."],"exampleFix":"// before: treating every Scan error as a hard failure\nif res := plugin.Scan(ctx, host, session); res.Error != nil {\n    log.Fatalf(\"scan failed: %v\", res.Error)\n}\n// after: distinguish 'not vulnerable' from real probe errors\nif res := plugin.Scan(ctx, host, session); res.Error != nil {\n    if strings.Contains(res.Error.Error(), i18n.GetText(\"ms17010_not_vulnerable\")) {\n        log.Printf(\"host not vulnerable, skipping\")\n    } else {\n        log.Printf(\"probe error: %v\", res.Error)\n    }\n}","handlingStrategy":"fallback","validationCode":"if host.Port != 445 { /* skip ms17010 plugin */ }","typeGuard":"func isNotVulnerable(res *ScanResult) bool { return res != nil && !res.Success && res.Error != nil && strings.Contains(res.Error.Error(), \"not_vulnerable\") }","tryCatchPattern":null,"preventionTips":["Only run the plugin against port-445 targets","Treat plugin Scan errors as verdicts, not crashes — inspect the message","Log success and error outcomes separately to avoid misinterpreting 'not vulnerable' as failure"],"tags":["go","smb","ms17010","vulnerability-scan","not-vulnerable"],"backgroundTag":"unsupported-operation","analyzedSha":"95cc12e753bf43de7004e5aef42a9ffba3934303","analyzedAt":"2026-09-06T17:07:30.094Z","contentChangedAt":"2026-09-06T17:07:30.094Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}